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DETAILED ACTION 

1. Claims 1-41 are subject to examination. 

2. This action is responsive' to appeal brief filed on 10/19/2006. In view of the 
appeal brief filed on 09/08/2006 t PROSECUTION IS HEREBY REOPENED. New 
grounds of rejections are set forth below. 

To avoid abandonment of the application, appellant must exercise one of the 
following two options: 

(1) file a reply under 37 CFR 1.111 (if this Office action is non-final) or a reply 
under 37 CFR 1 . 1 1 3 (if this Office action is final); or, 

(2) request reinstatement of the appeal. 

If reinstatement of the appeal is requested, such request must be accompanied 
by a supplemental appeal brief, but no new amendments, affidavits (37 CFR 
1.130, 1.131 or 1.132) or other evidence are permitted. See 37 CFR 1.193(b)(2). 

3. Examiner would like to thank the Applicant for providing the summary on the 
claimed subject matter, and explanation of the claimed limitations in relation to 
the specification by reference to Figures, pages and lines. Upon further 
consideration given to the understanding of the claimed limitations, new grounds 
of rejection is made as below. 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 
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5. Claims 7, 9, 10, 23, 25, 26, 38, 40 and 41 are rejected under 35 U.S.C. 101 
because the claimed invention is directed to non-statutory subject matter. 

The specification contains intrinsic evidence at page 35 stating that " While the 
invention has been described above in the general context of software tools and 
computer-executable instructions of a computer program that runs on a computer 
and/or computers, those skilled in the art will recognize that the invention also may be 
implemented in combination with other program modules. Generally, program modules 
include routines, programs, components, data structures, etc. that perform particular 
tasks and/or implement particular abstract data types." 
Referring to claim 7, 

Claim 7 recites "A software tool for...." is not statutory because it is directed to 
software, per se, lacking storage on a medium, which enables any underlying 
functionality to occur. 

Also Claim 7 recites limitations for "adapted to...." In line 3, 8, 13 and finally 
"correcting the location estimate.", as such attempting to claim a data structure, 
however the body of claim lacks the necessary functional interrelationship of the data to 
be a data structure and therefore the claim is only a collection of data which is non- 
functional descriptive material which is non statutory, even if the claims were in proper 
format to have a functional interrelationship, the claims would still be non statutory as a 
data structure per se, therefore lacks a practical application because it alone cannot 
produce its intended outcome. 
Referring to claims 9 and 10, 
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Claims 9 and 10 are claims to a "software" which is not statutory because it is 
directed to software, per se f lacking storage on a medium, which enables any 
underlying functionality to occur. 

Also, Claims 9 and 10 are attempting to claim a data structure, however the body 
of claim lacks the necessary functional interrelationship of the data to be a data 
structure and therefore the claim is only a collection of data which is non-functional 
descriptive material which is non statutory, even if the claims were in proper format to 
have a functional interrelationship, the claims would still be non statutory as a data 
structure per se, therefore lacks a practical application because it alone cannot produce 
its intended outcome. 
Referring to claim 23, 

Claim 23 recites "A software tool for...." is not statutory because it is directed to 
software, per se, lacking storage on a medium, which enables any underlying 
functionality to occur. 

Also Claim 23 recites limitations for "adapted to...." In line 3, 7,10, 14 and 15 
and finally "a location estimate.", as such attempting to claim a data structure, however 
the body of claim lacks* the necessary functional interrelationship of the data to be a 
data structure and therefore the claim is only a collection of data which is non-functional 
descriptive material which is non statutory, even if the claims were in proper format to 
have a functional interrelationship, the claims would still be non statutory as a data 
structure per se, therefore lacks a practical application because it alone cannot produce 
its intended outcome. 
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Referring to claims 25 and 26, 

Claims 25 and 26 are claims to a "software" which is not statutory because it is 
directed to software, per se, lacking storage on a medium, which enables any 
underlying functionality to occur. 

Also, Claims 25 and 26 are attempting to claim a data structure, however the 
body of claim lacks the necessary functional interrelationship of the data to be a data 
structure and therefore the claim is only a collection of data which is non-functional 
descriptive material which is non statutory, even if the claims were in proper format to 
have a functional interrelationship, the claims would still be non statutory as a data 
structure per se, therefore lacks a practical application because it alone cannot produce 
its intended outcome. 
Referring to claim 38, 

Claim 38 recites "A software tool for...." is not statutory because it is directed to 
software, per se, lacking storage on a medium, which enables any underlying 
functionality to occur. 

Also Claim 38 recites limitations for "adapted to...." In line 3, 5, 9, 11 and finally 
"computing dispersion metric", as such attempting to claim a data structure, however 
the body of claim lacks the necessary functional interrelationship of the data to be a 
data structure and therefore the claim is only a collection of data which is non-functional 
descriptive material which is non statutory, even if the claims were in proper format to 
have a functional interrelationship, the claims would still be non statutory as a data 
structure per se, therefore lacks a practical application because it alone cannot produce 
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its intended outcome. 
Referring to claims 40 and 41, 

Claims 40 and 41 are claims to a "software" which is not statutory because it is 
directed to software, per se ? lacking storage on a medium, which enables any 
underlying functionality to occur. 

Also, Claims 40 and 41 are attempting to claim a data structure, however the 
body of claim lacks the necessary functional interrelationship of the data to be a data 
structure and therefore the claim is only a collection of data which is non-functional 
descriptive material which is non statutory, even if the claims were in proper format to 
have a functional interrelationship, the claims would still be non statutory as a data 
structure per se, therefore lacks a practical application because it alone cannot produce 
its intended outcome. 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as 
set forth in section 102 of this title, if the differences between the subject matter sought to be patented 
and the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 1-1 1 are rejected under 35 U.S.C. 103(a) as being Unpatentable over 
Anderson et. al.(US 6, 684, 250) in view of Ahuja et al. (hereinafter Ahuja) (US 6, 981 , 
055 B1) 

Referring to claim 1, 
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Anderson teaches a computer implemented method (Fig. 1A, element 
"GEOLOCATION SYSTEM") of determining the location of as Internet host 
(ABSTRACT, "An estimated geographic location is selected from the plurality of 
geographic locations as being a best estimate of a true geographic location of the 
network address (Internet host) , where the selection of the estimated geographic 
location is based upon a degree of confidence-factor weighted agreement within the 
plurality of geographic locations.") using a computer system,, comprising the following 
computer executable acts (col. 16, line 29-35, "In an alternative embodiment of the 
present invention, no distinction is made between exact and inexact processes (as 
shown in FIG. 11), and all processes are regarded as being located on a common tier . 
The method 70 is performed by the analysis module 28, and employs each of the 
algorithms 61, 63 and 65."): 

obtaining route information (col. 15, line 32, "As described above, each of the 
data collection agents 18 may implement one of multiple data collection processes to 
obtain raw geolocation information. These data collection processes may, in one 
exemplary embodiment of the present invention, access any one or more of the 
following data sources:") relating to a network path between a host IP address 
associated with the Internet host and the computer system, wherein the network path 
comprises the computer system, the Internet host, and at least one intermediate 
network node (col. 15, line 55-60, "Traceroute: A traceroute shows the route of a data 
packet from a data collection machine to a target host. Much information can be 
derived from the analysis of a traceroute. For instance, if hop #10 is in California, and 
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hop #13 is in California, then with increased certainty, it can be inferred that hops #11 
and #12 are also in California."), and wherein the route information comprises a plurality 
of router labels associated with the host IP address and the at least one intermediate 
network node (col.8, line 14-20, "Typically, most network addresses (e.g., IP addresses) 
are associated with a particular geographic location. This is because routers that 
receive packets for a particular set of machines are fixed in location and have a fixed 
set of network addresses for which they receive packets. The machines that routers 
receive packets for tend to be geographically proximal to the routers."); 

extracting a location code from the route information corresponding to a router 
label associated with one of the Internet host and an intermediate network node 
proximate the Internet host (col. 52, line49-col. 53, line 16, "EXAMPLE 1 The last four 
hops in a traceroute form a distal-proximal relationship, meaning that the next hop is 
geographically closer to its next successive hop: Hop 5 is closer to hop 6 Hop 6 is 
closer to hop 7 Hop 7 is closer to hop 8 Thus, the traced route geographically 
progresses toward the final hop 8, leading to a decision that the destination is located 
within a certain range of accuracy. EXAMPLE 2 The point of origin is Denver, Colo., and 
the destination is Salt Lake City, Utah. The last four hops indicate a connection that is 
back-hauled through Denver, Colo., essentially geographically backtracking the route 
taken: 1 Denver Router 2 Grand Junction Router 3 Provo Utah Router 4 Salt Lake City 
Router 5 Salt Lake City Router 6 Denver Router 7 Provo Utah Router 8 Salt Lake City 
Router 9 Salt Lake City Destination This example indicates a geographic progression 
away from Denver toward Utah, directly back to Denver, and finally directly back to Utah 
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with a destination that does not leave Utah. Thus, a human may assume that even 
though the route taken was very indirect, it did terminate in Utah. Using 
Latitude/Longitude coordinates, the data collection agents 18 will see the same scenario 
and arrive at an intelligent conclusion.") 

consulting a data store comprising at least one data set having location codes 
and corresponding location information (Fig. 1A, elements 26 and 30, col. 10, line 39- 
42, "If the search was successful, this information will be placed directly into the data 
collection database 26 , at which time the analysis module 28 will determine an 
estimated geolocation of the searched addresses."); 

obtaining location information from the data store corresponding to the location 
code associated with the one of the Internet host and the intermediate network node 
proximate the Internet. host (col. 8, line 14-31, " For example, a traceroute search is 
conducted by a data collection agent 18 responsive to a search request received at a 
data collection agent 18 from a data collection broker 22. Each data collection agent 
18, responsive to a request, will perform a search (e.g., a traceroute ) to collect specified 
data, and determine the validity of the raw data utilizing built-in metrics. If successful, 
this data is provided to the data collection database 26 , via a data collection broker 22, 
for analysis by the analysis module 28. Each data collection agent 18 further advises a 
controlling data collection broker 22 of the success or failure of a particular search." 
Note: Database 26 of Fig. 2 has location information provided by collection agents along 
with it's metrics., col. 11, line 20-22 "At block 54, the analysis module 28 processes the 
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newly entered data within the data collection database 26, and writes this data to the 
data warehouse 30."); 

providing a location estimate of the location of the Internet host according to the 
location information from the data store corresponding to the location code (col. 15, line 
27-29, "As described above, each of the data collection agents 18 may implement one 
of multiple data collection processes to obtain raw qeolocation information .", col. 14, line 
1-3, ""Each data collection broker 22 further stores raw data (geolocation information) 
into the data collection database 26,."); 

Although, Anderson teaches "selectively correcting the location estimate" (Fig. 
4A, element "REFINED GEOLOCATION DATA", and use of process "latency 
calculations" at col. 17, line 42-48 by stating, "Moving on to FIG. 9B, at block 86, one or 
more "exact" geographic location processes (e.g., traceroutes, latency calculations , 
hostname matching and the DNS Loc LDM) are run to determine whether geolocation 
information can be determined for the subject network address, and optionally for other 
network addresses of the block of network addresses.", and col. 21, line 53-56, "This 
technique of "divide and conquer", combined with more selective pinging/tracerouting 
allows the subnet blocking algorithm to create a reduced impression in security logs of 
networks."col.3, line 11-24, Note: "comparing"), Anderson specifically fails to 
determining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Internet host along the network path; and the location 
estimate according to the delay time associated with the network path. 



Application/Control Number: 09/849,662 Page 1 1 

Art Unit: 2154 

Ahuja teaches the method of estimating location of a distance at Figs. 3-7 and at 
col. 8, line 4-63, "Referring to FIG. 3 for example, the observed latency to an IP address 
from a single source 200 can be converted to an approximation of the distance between 
the source 200 and the destination IP address 202. The estimated distance D is 
determined by combining the observed latency, such as 53 ms in the example shown, 
with an estimate of the speed (in distance per time) of the packets. For example, in 
fiber-optic cables, packets are known to travel at roughly two-thirds the speed of light in 
a vacuum. This rate will be affected by several factors including changes in the physical 
medium, curvature in the network paths, and latency added by routers or other devices, 
(determining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Internet host along the network path;) Given these 
variations, it is more reliable to determine the average rate through statistical 
observations than through analysis. An upper bound of this speed is easy to specify, 
however, since no packets can move faster than the speed of light. In this context, 
latency to a subnetwork is again defined as the average of the latencies to some set of 
representative IP addresses in that subnetwork. Once the distance is estimated 
between a source and the destination, a circle can be defined with radius equal to that 
distance and with a center located at the geographic location of the source. This is 
illustrated by circle 204 in FIG. 4 wherein source 200 is in the center and the radius of 
the circle is distance estimate D."( the location estimate according to the delay time 
associated with the network path.) 
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Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 of Anderson as 
shown in Fig. 11 such that estimation of the location of the internet host can be refined 
(corrected) as stated in Fig. 4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claim 2, 

Anderson teaches the method of claim 1, further comprising extracting the 
location code by examining the router labels in route order along the path from the host 
to the computer system until a location code is found that is usable to obtain location 
information from the data store (col. 21, line 21-28, (col. 52, line49-col. 53, line 16, 
"EXAMPLE 1 The last four hops in a traceroute form a distal-proximal relationship, 
meaning that the next hop is geographically closer to its next successive hop: Hop 5 is 
closer to hop 6 Hop 6 is closer to hop 7 Hop 7 is closer to hop 8 Thus, the traced route 
geographically progresses toward the final hop 8, leading to a decision that the 
destination is located within a certain range of accuracy. EXAMPLE 2 The point of origin 
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is Denver, Colo., and the destination is Salt Lake City, Utah. The last four hops indicate 
a connection that is back-hauled through Denver, Colo., essentially geographically 
backtracking the route taken: 1 Denver Router 2 Grand Junction Router 3 Provo Utah 
Router 4 Salt Lake City Router 5 Salt Lake City Router 6 Denver Router 7 Provo Utah 
Router 8 Salt Lake City Router 9 Salt Lake City Destination This example indicates a 
geographic progression away from Denver toward Utah, directly back to Denver, and 
finally directly back to Utah with a destination that does not leave Utah. Thus, a human 
may assume that even though the route taken was very indirect, it did terminate in Utah. 
Using Latitude/Longitude coordinates, the data collection agents 18 will see the same 
scenario and arrive at an intelligent conclusion."). 
Referring to claim 3, 

Anderson teaches the method of claim 2, further comprising: determining a 
confidence metric representative of the accuracy of the location estimate; and 
selectively providing the location estimate of the location of the Internet host if the 
confidence metric exceeds a threshold, (col. 17, line 42-53, col. 3, line 25-31, "In a 
further exemplary embodiment, the selecting of the estimated geographic location may 
include collapsing at least some of the confidence factors associated with the 
geographic locations into a confirmation confidence factor.( determining a confidence 
metric representative of the accuracy of the location estimate) The collapsing may 
comprise combining the plurality of confidence factors for a geographic location that 
exhibit a correspondence.", Fig. 25, elements 382-388, (selectively providing the 
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location estimate of the location of the Internet host if the confidence metric exceeds a 

threshold.)) 
Referring to claim 4, 

Anderson teaches the method of claim 3, further comprising: determining a 
confidence metric representative of the accuracy of the location estimate between the 
Internet host and the network node associated with the location estimate, (col. 21, line 
53-56, Fig. 25, elements 382-388,col. 46, line 8-23, The choice of the "best estimate" 
location determinant at block 388 is performed by identifying the location determinant 
that exhibits a highest degree of confidence factor-weighted agreement with _all the 
other location determinants.") 

Although, Anderson teaches at Fig. 4A, element "REFINED GEOLOCATION 
DATA", and use of process "latency calculations" at col. 17, line 42-48 by stating, 
"Moving on to FIG. 9B, at block 86, one or more "exact" geographic location processes 
(e.g., traceroutes, latency calculations , hostname matching and the DNS Loc LDM) are 
run to determine whether geolocation information can be determined for the subject 
network address, and optionally for other network addresses of the block of network 
addresses.", and col. 21, line 53-56, "This technique of "divide and conquer", combined 
with more selective pinging/tracerouting allows the subnet blocking algorithm to create a 
reduced impression in security logs of networks."col.3, line 11-24, Note: "comparing"), 
Anderson specifically fails to determining a confidence metric representative of the 
accuracy of the location estimate based upon the delay time between the Internet host 
and the network node associated with the location estimate. 
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Ahuja teaches the method of estimating location of a distance at Figs. 3-7 and at 
col. 8, line 4-63, "Referring to FIG. 3 for example, the observed latency to an IP address 
from a single source 200 can be converted to an approximation of the distance between 
the source 200 and the destination IP address 202. The estimated distance D is 
determined by combining the observed latency, such as 53 ms in the example shown, 
with an estimate of the speed (in distance per time) of the packets. For example, in 
fiber-optic cables, packets are known to travel at roughly two-thirds the speed of light in 
a vacuum. This rate will be affected by several factors including changes in the physical 
medium, curvature in the network paths, and latency added by routers or other devices. 
Given these variations, it is more reliable to determine the average rate through 
statistical observations than through analysis. An upper bound of this speed is easy to 
specify, however, since no packets can move faster than the speed of light. In this 
context, latency to a subnetwork is again defined as the average of the latencies to 
some set of representative IP addresses in that subnetwork. Once the distance is 
estimated between a source and the destination, a circle can be defined with radius 
equal to that distance and with a center located at the geographic location of the source. 
This is illustrated by circle 204 in FIG. 4 wherein source 200 is in the center and the 
radius of the circle is distance estimate D." 

Ahuja also teaches at col. , line, "After estimating the geographic location of each 
destination, an estimate of the distance between all pairs of destinations can be easily 
computed. If the distance between two destinations is extremely small, then it may be 
reasonably accurate to only measure the performance to one of the destinations and to 
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assume that the other destination will have the same performance. The accuracy of this 
inference depends on how close the two points are to each other, both topological^ and 
geographically. However, if they are geographically very close, they are more likely to 
be topological^ close. Therefore, the confidence in the inference should increase as 
the distance between the two points decreases." (a confidence metric representative of 
the accuracy of the location estimate based upon the delay time). 

Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 of Anderson as 
shown in Fig. 11 such that estimation of the location of the internet host can be refined 
(corrected) as stated in Fig. 4 A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claim 5, 

Anderson teaches the method of claim 1 , further comprising: 

obtaining route information (col. 15, line 32, "As described above, each of the 
data collection agents 18 may implement one of multiple data collection processes to 
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obtain raw geolocation information. These data collection processes may, in one 
exemplary embodiment of the present invention, access any one or more of the 
following data sources:") relating to each network path between the host IP address and 
each of a plurality of computer systems (col. 15, line 55-60, Traceroute: A traceroute 
shows the route of a data packet from a data collection machine to a target host. Much 
information can be derived from the analysis of a traceroute. For instance, if hop #10 is 
in California, and hop #13 is in California, then with increased certainty, it can be 
inferred that hops #11 and #12 are also in California."), wherein the route information 
comprises a plurality of router labels associated with the host IP address, and each of 
the plurality of computer systems, and at least one intermediate network node in each 
network path; (col.8, line 14-20, "Typically, most network addresses (e.g., IP addresses) 
are associated with a particular geographic location. This is because routers that 
receive packets for a particular set of machines are fixed in location and have a fixed 
set of network addresses for which they receive packets. The machines that routers 
receive packets for tend to be geographically proximal to the routers.", col. 52, line 42- 
col.53, line 16); 

extracting a location code for each network path from the route information 
corresponding to a router label associated with one of the Internet host and the at least 
one intermediate network node in each network path; (col. 52, line49-col. 53, line 16, 
"EXAMPLE 1 The last four hops in a traceroute form a distal-proximal relationship, 
meaning that the next hop is geographically closer to its next successive hop: Hop 5 is 
closer to hop 6 Hop 6 is closer to hop 7 Hop 7 is closer to hop 8 Thus, the traced route 
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geographically progresses toward the final hop 8, leading to a decision that the 
destination is located within a certain range of accuracy. EXAMPLE 2 The point of origin 
is Denver, Colo., and the destination is Salt Lake City, Utah. The last four hops indicate 
a connection that is back-hauled through Denver, Colo., essentially geographically 
backtracking the route taken: 1 Denver Router 2 Grand Junction Router 3 Provo Utah 
Router 4 Salt Lake City Router 5 Salt Lake City Router 6 Denver Router 7 Provo Utah 
Router 8 Salt Lake City Router 9 Salt Lake City Destination This example indicates a 
geographic progression away from Denver toward Utah, directly back to Denver, and 
finally directly back to Utah with a destination that does not leave Utah. Thus, a human 
may assume that even though the route taken was very indirect, it did terminate in Utah. 
Using Latitude/Longitude coordinates, the data collection agents 18 will see the same 
scenario and arrive at an intelligent conclusion." ,col. 52, line 42-col.53, line 16)) 

obtaining location information from the data store corresponding to each location 
code (Fig. 1A, elements 26 and 30, col. 10, line 39-42, "If the search was successful, 
this information will be placed directly into the data collection database 26 . at which time 
the analysis module 28 will determine an estimated geolocation of the searched 
addresses."); 

providing a plurality of location estimates of the location of the Internet host 
according to the location information from the data store corresponding to each location 
code (col. 15, line 27-29, "As described above, each of the data collection agents 18 
may implement one of multiple data collection processes to obtain raw geolocation 
information .", col. 14, line 1-3, ""Each data collection broker 22 further stores raw data 
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(geolocation information) into the data collection database 26,.", col. 52, line 42-col.53, 
line 16)); 

and correlating at least two of the location estimates to provide an improved 
location estimate of the location of the Internet host. (col. 21, line 53-56, col. 17, line 42- 
53, col. 3, line 25-31, "In a further exemplary embodiment, the selecting of the estimated 
geographic location may include collapsing at least some of the confidence factors 
associated with the geographic locations into a confirmation confidence factor.( 
determining a confidence metric representative of the accuracy of the location estimate) 
The collapsing may comprise combining the plurality of confidence factors for a 
geographic location that exhibit a correspondence.", Fig. 25, elements 382-388,) 
Referring to claim 6, 

Anderson teaches the method of claim 1 , wherein the location code comprises 
one of a city code, and airport code, and a country code, and wherein obtaining the 
route information comprises using a traceroute tool. (col. 29, line 44-65) 
Referring to claim 7, 

Claim 7 is a claim to a software tool for carrying out the method steps of claim 1 . 
Therefore claim 7 is rejected for the reasons set forth for claim 1 . 
Referring to claim 8, 

Claim 8 is a claim to a computer-readable medium having computer executable 
instructions for carrying out the method steps of claim 1 . Therefore claim 8 is rejected 
for the reasons set forth for claim 1 . 
Referring to claim 9, 
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Claim 8 is a claim to a system for carrying out the method steps of claim 1 . Therefore 
claim 8 is rejected for the reasons set forth for claim 1 . 
Referring to claim 10, 

Claim 10 is a claim for geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process that includes the method of claim 1 . 
Therefore claim 10 is rejected for the reasons set forth for claim 1 . 
Referring to claim 11, 

Claim 1 1 is a claim to method that includes the method steps of claim 1 (using multiple 
computer systems). Therefore claim 1 1 is rejected for the reasons set forth for claim 1 . 
7. Claims 14-22 and 27-41 are rejected under 35 U.S.C. 103(a) as being 
Unpatentable over Ahuja et al. (hereinafter Ahuja) (US 6, 981, 055 B1) in view of 
Anderson et. al.(US 6, 684, 250) 
Referring to claim 14, 

Ahuja teaches the method of claim 12, wherein correlating the first, second, and 
third delay times (This is also illustrated in FIG. 6, wherein destination 202 lies within the 
intersection of circles 204, 210, 212). Let us note the teachings of Ahuia at col. 6, 
line62-67, "Performance and other path characteristics as described above will 
generally be measured by probing to specific IP addresses using the path offered by a 
specific next-hop AS. However, routing on the Internet is specified at the granularity of 
subnetworks (also known as prefixes), which are ranges of IP addresses.) comprises: a 
data store comprising N sets of first, second, and third delay measurements between 
the first, second, and third computer systems, respectively, and N known hosts, as well 



Application/Control Number: 09/849,662 Page 21 

Art Unit: 2154 

as location information associated with the N known hosts, wherein N is an integer, (col. 
9, line 19- col. 10, line 40, "For example, referring to FIG. 7, if there are three prefixes, 
PR1, PR2, and PR3, and if latency or measurements of other path characteristics have 
been made from some source AS1 to each of PR1 and PR2 using a specific next-hop 
AS2, then it is possible to infer the latency or path characteristic to PR3 using the path 
offered by AS2. Let L(AS_X, AS_Y, PR_Z) represent the latency from the AS AS_X to 
the prefix PR_Z when the path offered by AS_Y is used. Also let D(PR_X, PR_Y) 
represent the distance between prefix PR_X and prefix PR_Y. It is possible to infer the 
latency from AS1 to PR3 using AS2 as the next-hop AS using the equation ##EQU1## 
Although measurements to only two prefixes were used in this example, in practice a 
large number of measurements should be used to make any single inference(a data 
store comprising N sets of first, second, and third delay measurements between the 
first, second, and third computer systems, respectively, and N known hosts, and "t he 
first, second, and third delay times with the N sets of first, second, and third delay 

measurements ) "However, an AS may be connected to multiple ASes and, therefore, 

it is likely that more than one next-hop AS will be available for sending traffic to a 
destination. Therefore, for further clarification, if L(AS1 , AS3, PR3) were being inferred, 
then the measurements would also have to use AS3 as the next hop. A similar 
computation would be carried out for each of the next-hop ASes.", and "1. Monitoring 
sets of prefixes and then treating all prefixes in the set in the same fashion. 2. 
Aggregating prefix sets based on similarities and treating all such aggregated prefix sets 
in the same fashion 4. Placing prefixes into sets based on some criteria of 



Application/Control Number: 09/849,662 Page 22 

Art Unit: 2154 

similarity such as, but not limited to, performance, geographical location (determining a 
set of first, second, and third delay measurements; and providing a location estimate of 
the Internet host), and other correlation factors, and treating all prefixes in the sets in 
the same fashion.". 

Ahuja fails to teach consulting such a data store and performing a comparison of 
the first, second, and third delay times with the N sets of first, second, and third delay 
measurements in the data store ; determining a nearest set of first, second, and third 
delay measurements according to the comparison; and providing a location estimate of 
the Internet host . 

Anderson teaches at Fig. 4A, element "REFINED GEOLOCATION DATA", and 
use of process "latency calculations" at col. 17, line 42-48 by stating, "Moving on to FIG. 
9B, at block 86, one or more "exact" geographic location processes (e.g., traceroutes, 
latency calculations , hostname matching and the DNS Loc LDM) are run to determine 
whether geolocation information can be determined for the subject network address, 
and optionally for other network addresses of the block of network addresses." And 
Anderson teaches at col. 3, line 17-20, "The selection of the estimated geographic 
location may, for example, include comparing each of the plurality of geographic 
locations potentially associated with the network address against at least some of the 
further geographic locations of the plurality of geographic locations." (consulting such a 
data store and performing a comparison of the first, second, and third delay times with 
the N sets of first, second, and third delay measurements in the data store ; determining 
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a nearest set of first, second, and third delay measurements according to the 
comparison: and providing a location estimate of the Internet host .) 

Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 of Anderson as 
shown in Fig. 1 1 such that estimation of the location of the internet host can be refined 
(corrected) as stated in Fig. 4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute freguentlv provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claim 15, 

Ahuja teaches the method of claim 14 of the first, second, and third delay times 
with the N sets of first, second, and third delay measurements (Figs. 3-7) comprises 
determining N Euclidian distances corresponding to the Euclidian distances between 
the N sets of first, second, and third delay measurements in the data store and the first, 
second, and third delay times, (col. 8, line 31-33, "For example, FIG. 5 shows three 
sources 200, 206, 208 having distance estimates D1, D2, and D3 to destination 202, 
respectively.") and wherein providing a location estimate of the Internet host according 
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to set of fist, second, and third delay measurements comprises selecting location 
information associated with the set of first, second, and third delay measurements 
associated with the Euclidian distance as the location estimate, (col. 9, line 19- col. 10, 
line 40, "For example, referring to FIG. 7, if there are three prefixes, PR1, PR2, and 
PR3, and if latency or measurements of other path characteristics have been made 
from some source AS1 to each of PR1 and PR2 using a specific next-hop AS2, then it is 
possible to infer the latency or path characteristic to PR3 using the path offered by AS2. 
Let L(AS_X, AS_Y, PR_Z) represent the latency from the AS AS_X to the prefix PR_Z 
when the path offered by AS_Y is used. Also let D(PR_X, PR_Y) represent the 
distance between prefix PR_X and prefix PR_Y. It is possible to infer the latency from 
AS1 to PR3 using AS2 as the next-hop AS using the equation ##EQU1## Although 
measurements to only two prefixes were used in this example, in practice a large 
number of measurements should be used to make any single 

inference." "However, an AS may be connected to multiple ASes and, 

therefore, it is likely that more than one next-hop AS will be available for sending traffic 
to a destination. Therefore, for further clarification, if L(AS1, AS3, PR3) were being 
inferred, then the measurements would also have to use AS3 as the next hop. A similar 
computation would be carried out for each of the next-hop ASes.", and "1. Monitoring 
sets of prefixes and then treating all prefixes in the set in the same fashion. 2. 
Aggregating prefix sets based on similarities and treating all such aggregated prefix sets 
in the same fashion 4. Placing prefixes into sets based on some criteria of 
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similarity such as, but not limited to, performance, geographical location and other 
correlation factors, and treating all prefixes in the sets in the same fashion.". 

Ahuja fails to teach wherein performing the comparison of the first, second, and 
third delay times with the N sets of first, second, and third delay measurements in the 
data store comprises determining N Euclidian distances corresponding to the Euclidian 
distances between the N sets of first, second, and third delay measurements in the data 
store and the first, second, and third delay times, and wherein providing a location 
estimate of the Internet host according to the nearest set of fist, second, and third delay 
measurements comprises selecting location information associated with the set of first, 
second, and third delay measurements in the data store associated with the smallest 
Euclidian distance as the location estimate. 

Anderson teaches at Fig. 4A, element "REFINED GEOLOCATION DATA", and 
use of process "latency calculations" at col. 17, line 42-48 by stating, "Moving on to FIG. 
9B, at block 86, one or more "exact" geographic location processes (e.g., traceroutes, 
latency calculations , hostname matching and the DNS Loc LDM) are run to determine 
whether geolocation information can be determined for the subject network address, 
and optionally for other network addresses of the block of network addresses." And 
Anderson teaches at col. 3, line 17-20, "The selection of the estimated geographic 
location may, for example, include comparing each of the plurality of geographic 
locations potentially associated with the network address against at least some of the 
further geographic locations of the plurality of geographic locations." , col. 42, line 40-45, 
"Comments: An exemplary embodiment of the confidence map 332 is illustrated in FIG. 
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21 B. This confidence map 332 gives relatively high confidence factors if and only if the 
hosts are close together (in the traceroute) and at the end of the traceroute. Other 
scenarios receive low or zero confidence factors. "col. 40, line 37-65, col. 42, line 46-54). 
( wherein performing the comparison of the first, second, and third delay times with the N 
sets of first, second, and third delay measurements in the data store comprises 
determining N Euclidian distances corresponding to the Euclidian distances between 
the N sets of first, second, and third delay measurements in the data store and the first, 
second, and third delay times, and wherein providing a location estimate of the Internet 
host according to the nearest set of fist, second, and third delay measurements 
comprises selecting location information associated with the set of first, second, and 
third delay measurements in the data store associated with the smallest Euclidian 
distance as the location estimate.} \ 

Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 such that 
estimation of the location of the internet host can be refined (corrected) as stated in Fig. 
4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
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selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claims 16, 

Keeping in mind the teachings of Ahuja as stated above for claim 12, wherein 
Ahuja teaches the method of claim 12, wherein correlating the fast, second, and third 
delay times (Figs. 3-7) , however, Ahuja fails to teach computing a first probability 
density function establishing a relationship between a first network delay associated 
with the first computer system and a first distance from the first computer system; 
determining a first distance estimate representative of the distance between the first 
computer system and the location of the Internet host using the first delay time and the 
first probability density function; computing a second probability density function 
establishing a relationship between a second network delay associated with the second 
computer system and a second distance from the second computer system; 
determining a second distance estimate representative of the distance between the 
second computer system and the location of the Internet host using the second delay 
time and the second probability density function; computing a third probability density 
function establishing a relationship between a third network delay associated with the 
third computer system and a third distance from, the third computer system; and 
determining a third distance estimate representative of the distance between the third 
computer system and the location of the Internet host using the third delay time and the 
third probability density function; and wherein providing the location estimate comprises 
triangulating the first, second, and third distance estimates. 
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Anderson teaches a concept and a method of calculating the probability density 
associated with each number of possible locations, which is of a paramount importance 
at col. 23, line 7-26, "In one embodiment, the unified mapping process 61 takes into 
account all information available from such methodologies, and a probability (or 
confidence factor) associated with each , and establishes a unique location . The 
associated probability that serves as a confidence factor for the unique location. In one 
embodiment, the unified mapping process 61 is implemented as a Bayesian network 
that takes into account information regarding possible city and the state locations, 
results conflicts (e.g., there may be contradictory city/city indications or inconsistent 
cities/state combinations, and calculates) a final unique location and the associated 
probability. A probability for each of a number of possible locations that are inputted to 
the unified mapping process 61 is calculated utilizing the Bayesian network, in one 
exemplary embodiment of the present invention. For example, if there is one possible 
location with a very high probability and a number of other possible locations with 
smaller probabilities, the location with the highest probability may be picked, and its 
associated probability returned." (computing a probability density function establishing a 
relationship between the computer system and a distance from, the computer system; 
and determining a distance estimate representative of the distance between the 
computer system and the location of the Internet host using the probability density 
function) 

Anderson also teaches at col. 15, line 8-13, "The analysis module 28, according 
to one exemplary embodiment, operates to extract raw data from the data collection 
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database 26, process the data according to one or more analysis algorithms (or 
modules) to generate a location probability table, and to store results and the raw data 
into the data warehouse 30., "col. 9, line 25-29, "In the manner described in further 
detail below, the data collection and analysis system 12 generates a location 
determinant, indicating at least one geographic location, and an associated location 
probability table , that is communicated back to the customer, (computing a probability 
density function establishing a relationship between the computer system and all 
information available from the methodologies as stated above , and a distance from the 
computer system). 

Anderson also teaches the concept and "triangulation" technique at col. 53, line 
17-31, Triangulation Using a translation process, in one exemplary embodiment of the 
present invention, an approximate radius containing the target network address be 
generated. Launching a latitude/longitude route discovery from geographically disperse 
locations, the final destination will likely proceed through the same set of routers. Thus, 
if the final 3 hops leading up to the point of entry into the destination network are 
proximal, or at the very least, form a line toward the destination's point of entry, one may 
assume that the destination resides within the common latitude/longitude coordinates. 
Using the attitude/latitude coordinates of other known landmarks allows a radius to be 
computed. Within this radius, metro areas and large cities will be known." (wherein 
providing the location estimate comprises triangulating the first, second, and third 
distance estimates.) (please also refer to additional teachings substantiating the 
probability density function calculation for all information available from the 
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methodologies used for determining the geolocation of the host at col. 14, line 25-40, 
col. 21, 53-56, col. 16, line 21-35, col. 14, line 25-35, col. 53, line 17-col. 54, line 5). 

Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 such that 
estimation of the location of the internet host can be refined (corrected) as stated in Fig. 
4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claims 17, 

Keeping in mind the teachings of Ahuja as stated above for claim 16, Ahuja fails 
to teach wherein determining the first, second, and third distance estimates further 
comprises computing an error function over a location space, and determining 
coordinates within the location space where the error function is minimized. 

Anderson teaches the method of claim 16, wherein determining the first, second, 
and third distance estimates further comprises computing an error function over a 
location space, and determining coordinates within the location space where the error 
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function is minimized, (col. 15, line 52-54, "DNS Loc Record: Occasionally, a DNS 
Location (Loc for short) record is stored, which indicates the precise latitude, longitude, 
and elevation of a host (coordinates within the location space).", col. 23, line 7-26The 
unified mapping process 61 operates to combine the results of a number of mapping 
methodologies that do not yielded exact results (e.g., combines the results of the 
inexact algorithms). In one embodiment, the unified mapping process 61 takes into 
account all information available from such methodologies, and a probability (or 
confidence factor) associated with each, and establishes a unique location. The 
associated probability that serves as a confidence factor for the unique location", col. 
52, line 28-35, "In one embodiment of the present invention, a latitude and longitude 
matching process may be utilized used to assist in the determination the geographic 
location of a given record. Only a network address (e.g., and IP address) is required for 
the longitude and latitude matching process to be successful. However, additional 
information, such as the owner's location, or proximal routers, may be utilized to achieve 
a higher probability of success. (computing an error function over a location space, and 
determining coordinates within the location space where the error function is 
minimized.). 

Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 such that 
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estimation of the location of the internet host can be refined (corrected) as stated in Fig. 
4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claims 18, 

Keeping in mind the teachings of Ahuja as stated above for claim 17, Ahuja fails 
to teach wherein determining coordinates within the location space where the error 
function is minimized comprises minimizing the error function across a list of known city 
locations, and wherein providing the location estimate comprises providing the known 
city location corresponding with the minimum value of the error function. 

Anderson, along with the teachings indicated for claim 17 above , teaches at col. 
16, line 5-19, "Demographic/Geographic Data: Implicit in much of the decision making 
processes is information about the different locations of the world. The analysis module 
28, in one embodiment, utilizes a demographic/geographic database 31, shown in 
FIGS. 1B and 2 to be part of the data warehouse 30, storing a city record for every city 
in the U.S.A. and all foreign cities with populations of greater than 100,000 people. 
Tied to each city are its state, country, continent, DMA (Designated Marketing Area), 
MSA (Metropolitan Statistical Area). PMSA (Primary Metropolitan Statistical Area), 
location latitude & longitude), sets of zip/postal codes, congressional districts, and area 
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codes . Each city record also has population and a connectivity index, which is based 
on the number of major carriers that have presence in that city."( determining 
coordinates within the location space where the error function is minimized comprises 
minimizing the error function across a list of known city locations, and wherein providing 
the location estimate comprises providing the known city location corresponding with 
the minimum value of the error function.) 

Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 such that 
estimation of the location of the internet host can be refined (corrected) as stated in Fig. 
4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claims 19, 20, 21, and 22, 

Keeping in mind the teachings of Ahuja as stated above for claims 17 and 18, 
Ahuja fails to teach the method of claim 18, wherein computing the error function 
comprises using a weighted least mean squares algorithm to optimize the location 
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estimate., and the method of claim 18, wherein computing the error function comprises 
using a probability density estimation to optimize the location estimate, and the method 
of claim 18, wherein computing the error function comprises using a weighted least 
mean squares algorithm to prune a solution space, and using a probability density 
estimation to optimize the location estimate from the pruned solution space, and the 
method of claim 18, wherein computing the error function comprises using a probability 
density estimation to prune a solution space, and using a weighted least mean squares 
algorithm to optimize the location estimate from the pruned solution space. 

Anderson, along with the teachings indicated for claims 17 and 18 above , 
teaches the method of claim 18, wherein computing the error function comprises using 
a weighted least mean squares algorithm to optimize the location estimate., and the 
method of claim 18, wherein computing the error function comprises using a probability 
density estimation to optimize the location estimate, and the method of claim 18, 
wherein computing the error function comprises using a weighted least mean squares 
algorithm to prune a solution space, and using a probability density estimation to 
optimize the location estimate from the pruned solution space, and the method of claim 
18, wherein computing the. error function comprises using a probability density 
estimation to prune a solution space, and using a weighted least mean squares 
algorithm to optimize the location estimate from the pruned solution space, (col. 27, line 
52- col. 28, line 6, col. 2, line 42- col. 3, line 9, col. 14, line 25-40, col. 21, 53-56, col. 16, 
line 21-35, col. 14, line 25-35, col. 53, line 17-col. 54, line 5). 
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Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 of Anderson as 
shown in Fig. 11 such that estimation of the location of the internet host can be refined 
(corrected) as stated in Fig. 4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claim 27, 

Ahuja teaches at teaches a method of determining the location of an Internet 
host using a first computer system comprising the following computes executable acts 
(Figs. 3-7) and clustering together IP addresses corresponding to hosts in the same 
geographic location according to network routing information to obtain cluster 
information (col. 10, line 8-39, "Furthermore, while the foregoing technique for inferring 
path characteristics is preferred, it will be appreciated that inferences can be made in 
other ways, including, but not limited to, the following: 

1 . Monitoring sets of prefixes and then treating all prefixes in the set in the same 
fashion.. 
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2. Aggregating prefix sets based on similarities and treating all such aggregated 
prefix sets in the same fashion. 

3. Deaggregating prefix sets into subsets that have similar characteristics and 
treating the subsets in the same fashion. 

4. Placing prefixes into sets based on some criteria of similarity such as, but not 
limited to, performance, geographical location, and other correlation factors, and 
treating all prefixes in the sets in the same fashion. 

Note that a set can be a single prefix, a group of prefixes , the union of two sets 
wherein the two sets are geographically close, the union of two sets wherein the two 
sets experience similar performance in relation to ASes, sets of sets and the like. 

Lastly, additional improvements to the technique for inferring path characteristics 
described herein can include, but are not limited to, the following 

1 . Making the performance measurement over the same AS path as the AS path 
of the destination for which path characteristics are to be inferred. 

2. Adding topology, as determined by traceroute . to the inference technique. In 
that event, each measurement can be weighted by the length of the path that is 
common to both the measured destination and to the destination for which the inference 
is being performed, (clustering together IP addresses corresponding to hosts in the 
same geographic location according to network routing information to obtain cluster 
information, Please note that "prefixes" are as at taught by Ahuja at col. 6, line 65-67, 
"However, routing on the Internet is specified at the granularity of subnetworks (also 
known as prefixes), which are ranges of IP addresses .") 
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Ahuja also teaches at col. 8, line 42-64, "Note that a tight upper bound of each 
distance will result in a smaller intersection region and hence a more precise estimate of 
the geographic location of the destination. In addition, adding more sources, especially 
ones that are geographically diverse with respect to the destination, will further reduce 
the intersection region and increase the precision of the estimate. In addition, 
making more measurements and selecting the lowest latency measurement will further 
decrease the size of the region of intersection. Furthermore, this method can be used 
both for specific IP addresses and for subnetworks, with the appropriate distance used 
in each case. Note also, that the sources used in these latency measurements for the 
purpose of identifying geographic location do not have to be the same sources that are 
used for monitoring performance and other path characteristics. Whereas the latencies 
that are collected for monitoring performance and other path characteristics need to be 
collected from the perspective of the AS that is using those measurements to make 
routing decisions, the geographic location of any IP address or subnetwork is not 
relative to the source, and so could be determined from the perspective of any AS ." 
(computing a dispersion metric representative of the accuracy of the location estimate of 
the location of the Internet host.) 

Ahuja fails to teach obtaining partial IP-to-location mapping information from a 
data source; obtaining network routing information; correlating the partial IP-to-location 
information with the cluster information providing a location estimate of the location of 
the Internet host according to the correlation of the partial IP-to-location information and 
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the cluster information; and computing a dispersion metric representative of the 
accuracy of the location estimate of the location of the Internet host. 

Anderson teaches at col. 27, line 6-20 col. 38, line 27-57, "The method by which 
the Autonomous System Network (ASN) LDM 136 operates to identify one more 
geographic locations for network addresses (obtaining partial IP-to-location mapping 
information from a data source; obtaining network routing information), and to assign at 
least one confidence factor to each of the geographic locations, is similar to the 
methods 240 and 270 of other two internet registry LDMs (i.e., the Net LDM 132 and the 
DNS LDM 134). Specifically, as opposed to the deploying external data collection 
routines to gather Net and DNS records, the ASN LDM 136 deploys the external data 
collection routines to gather the Autonomous System data, and parse it for meaningful 
geographic data. If ASN data is available, then the ASN LDM 136 can run. (correlating 
the partial IP-to-location information with the cluster information) An exemplary 
collection of confidence maps that may be utilized by the ASN LDM 136 to attach 
confidence factors to location determinants are discussed below with reference to FIGS. 
19A-19E. The confidence factors generated by the ASN LDM 136 come from distance 
to LKH and NKH, the size of the network, the position in the traceroute . population and 
n ectivjty . ) (providing a location estimate of the location of the Internet host 
the correlation of the partial IP-to-location information and the cluster 

been an obvious to one of an ordinary skill in art, having 
Ahuja in front of him at the time of invention was 
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made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 of Anderson as 
shown in Fig. 1 1 such that estimation of the location of the internet host can be refined 
(corrected) as stated in Fig. 4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claims 28 and 29, 

Ahuja teaches the method of claim 27, wherein obtaining network routing 
information comprises using a routing protocol, and the method of claim 28, wherein the 
routing protocol is one of BGP.R1P, OSPF, IGRP, and EGP. (col. 3, line 54-57, 
"Another object of the invention is to communicate routing information derived from 
optimized routing tables to BGP routers." 
Referring to claim 30, 

Ahuja teaches the method of claim 27, wherein clustering together IP addresses 
corresponding to hosts in the same geographic location according to network routing 
information to obtain cluster information comprises associating an address prefix used 
by a routing protocol with a geographical location, (col. 6, line 65-67, "However, routing 
on the Internet is specified at the granularity of subnetworks (also known as prefixes). 
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which are ranges of IP addresses .", col. 1, line 45-52, "Subnetting breaks up the 
address space into several subnetworks (which are identified by address prefixes), each 
of which represents a contiguous block of addresses. An AS contains a collection of 
subnets. Each such collection is disjoint in that a given prefix can be found in only one 
AS. The unique AS that contains a given prefix is responsible for delivering packets to 
all of the IP addresses in that prefix:) 
Referring to claim 31, 32, 33 and 34, 

Anderson teaches the method of claim 30, further comprising: sub-dividing the 
geographical location associated with the address prefix into at least two clusters 
according to a geographical spread associated with the geographical location., and the 
method of claim 27, further comprising sub-dividing the cluster information according to 
a geographical spread associated with the geographical location, and the method of 
claim 27, further comprising selectively providing the location estimate if the dispersion 
metric is less than a threshold value, and the method of claim 33, further comprising a 
threshold value that is dependent on the size of the cluster.(col. 10, line 8-39, 
"Furthermore, while the foregoing technique for inferring path characteristics is 
preferred, it will be appreciated that inferences can be made in other ways, including, 
but not limited to, the following: 

1 . Monitoring sets of prefixes and then treating all prefixes in the set in the same 
fashion.. 

2. Aggregating prefix sets based on similarities and treating all such aggregated 
prefix sets in the same fashion. 
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3. Deaggregating prefix sets into subsets that have similar characteristics and 
treating the subsets in the same fashion. 

4. Placing prefixes into sets based on some criteria of similarity such as, but not 
limited to, performance, geographical location, and other correlation factors, and 
treating all prefixes in the sets in the same fashion. 

Note that a set can be a single prefix, a group of prefixes , the union of two sets 
wherein the two sets are geographically close, the union of two sets wherein the two 
sets experience similar performance in relation to ASes, sets of sets and the like (sub- 
dividing the geographical location associated with the address prefix into at least two 
clusters according to a geographical spread associated with the geographical location., 
and the method of claim 27, further comprising sub-dividing the cluster information 
according to a geographical spread associated with the geographical location) 

Lastly, additional improvements to the technique for inferring path characteristics 
described herein can include, but are not limited to, the following 

1 . Making the performance measurement over the same AS path as the AS path 
of the destination for which path characteristics are to be inferred. 

2. Adding topology, as determined by traceroute , to the inference technique. In 
that event, each measurement can be weighted by the length of the path that is 
common to both the measured destination and to the destination for which the inference 
is being performed. Please note that "prefixes" are as at taught by Ahuja at col. 6, line 
65-67, "However, routing on the Internet is specified at the granularity of subnetworks 
(also known as prefixes), which are ranges of IP addresses .") 
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Ahuja also teaches at col. 8, line 42-64, "Note that a tight upper bound of each 
distance will result in a smaller intersection region and hence a more precise estimate of 
the geographic location of the destination. In addition, adding more sources, especially 
ones that are geographically diverse with respect to the destination, will further reduce 
the intersection region and increase the precision of the estimate. In addition, 
making more measurements and selecting the lowest latency measurement will further 
decrease the size of the region of intersection. Furthermore, this method can be used 
both for specific IP addresses and for subnetworks, with the appropriate distance used 
in each case. Note also, that the sources used in these latency measurements for the 
purpose of identifying geographic location do not have to be the same sources that are 
used for monitoring performance and other path characteristics. Whereas the latencies 
that are collected for monitoring performance and other path characteristics need to be 
collected from the perspective of the AS that is using those measurements to make 
routing decisions, the geographic location of any IP address or subnetwork is not 
relative to the source, and so could be determined from the perspective of any AS.", col. 
10, line 5-7, "The relative size of the "out-of-sample" data can be decreased until the 
root-mean-square (RMS) of the error is within an acceptable threshold. '^(selectively 
providing the location estimate if the dispersion metric is less than a threshold value, 
and the method of claim 33, further comprising a threshold value that is dependent on 
the size of the cluster.) 
Referring to claim 35, 
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Keeping in mind the teachings of Ahuja as stated above for claim 27, Ahuja fails 
to teach the method of claim 27, further comprising: obtaining route information relating 
to a first network path between a host IP address associated with the Internet host and 
the first computer system, wherein the first network path comprises the first computer 
system, the Internet host, and at least one intermediate network mode, and wherein the 
route information comprises a plurality of router labels associated with the host IP 
address and the at least one intermediate network node; extracting a first location code 
from the route information corresponding to a router label associated with one of the 
internet host and an intermediate network node proximate the Internet host; consulting 
a data store comprising at least one data set having location codes and corresponding 
location information; obtaining first location information from the data store 
corresponding to the first location code associated with the one of the Internet host and 
the intermediate network node proximate the Internet host; and providing a first location 
estimate of the location of the Internet host according to the first location information 
from the data store corresponding to the first location code. 

Anderson teaches obtaining route information (col. 15, line 32, "As described 
above, each of the data collection agents 18 may implement one of multiple data 
collection processes to obtain raw geolocation information. These data collection 
processes may, in one exemplary embodiment of the present invention, access any one 
on more of the following data sources:") relating to a first network path between a host 
IP address associated with the Internet host and the first computer system, wherein the 
first network path comprises the first computer system, the Internet host, and at least 
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one intermediate network node (col. 15, line 55-60, Traceroute: A traceroute shows the 
route of a data packet from a data collection machine to a target host. Much information 
can be derived from the analysis of a traceroute. For instance, if hop #10 is in 
California, and hop #13 is in California, then with increased certainty, it can be inferred 
that hops #11 and #12 are also in California."), and wherein the route information 
comprises a plurality of router labels associated with the host IP address and the at 
least one intermediate network node (col.8, line 14-20, "Typically, most network 
addresses (e.g., IP addresses) are associated with a particular geographic location. 
This is because routers that receive packets for a particular set of machines are fixed in 
location and have a fixed set of network addresses for which they receive packets. The 
machines that routers receive packets for tend to be geographically proximal to the 
routers."); 

extracting a first location code from the route information corresponding to a 
router label associated with one of the Internet host and an intermediate network node 
proximate the Internet host (col. 52, line49-col. 53, line 16, "EXAMPLE 1 The last four 
hops in a traceroute form a distal-proximal relationship, meaning that the next hop is 
geographically closer to its next successive hop: Hop 5 is closer to hop 6 Hop 6 is 
closer to hop 7 Hop 7 is closer to hop 8 Thus, the traced route geographically 
progresses toward the final hop 8, leading to a decision that the destination is located 
within a certain range of accuracy. EXAMPLE 2 The point of origin is Denver, Colo., and 
the destination is Salt Lake City, Utah. The last four hops indicate a connection that is 
back-hauled through Denver, Colo., essentially geographically backtracking the route 
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taken: 1 Denver Router 2 Grand Junction Router 3 Provo Utah Router 4 Salt Lake City 
Router 5 Salt Lake City Router 6 Denver Router 7 Provo Utah Router 8 Salt Lake City 
Router 9 Salt Lake City Destination This example indicates a geographic progression 
away from Denver toward Utah, directly back to Denver, and finally directly back to Utah 
with a destination that does not leave Utah. Thus, a human may assume that even 
though the route taken was very indirect, it did terminate in Utah. Using 
Latitude/Longitude coordinates, the data collection agents 18 will see the same scenario 
and arrive at an intelligent conclusion.") 

consulting a data store comprising at least one data set having location codes 
and corresponding location information (Fig. 1A, elements 26 and 30, col. 10, line 39- 
42, "If the search was successful, this information will be placed directly into the data 
collection database 26 , at which time the analysis module 28 will determine an 
estimated geolocation of the searched addresses."); 

obtaining first location information from the data store corresponding to the first 
location code associated with the one of the Internet host and the intermediate network 
node proximate the Internet host (col.8, line 14-31, " For example, a traceroute search is 
conducted by a data collection agent 18 responsive to a search request received at a 
data collection agent 18 from a data collection broker 22. Each data collection agent 
18, responsive to a request, will perform a search (e.g., a traceroute ) to collect specified 
data, and determine the validity of the raw data utilizing built-in metrics. If successful, 
this data is provided to the data collection database 26 . via a data collection broker 22, 
for analysis by the analysis module 28. Each data collection agent 18 further advises a 
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controlling data collection broker 22 of the success or failure of a particular search." 
Note: Database 26 of Fig. 2 has location information provided by collection agents along 
with it's metrics.); 

providing a first location estimate of the location of the Internet host according to 
the first location information from the data store corresponding to the first location code 
(col. 15, line 27-29, "As described above, each of the data collection agents 18 may 
implement one of multiple data collection processes to obtain raw qeolocation 
information .", col. 14, line 1-3, ""Each data collection broker 22 further stores raw data 
(geolocation information) into the data collection database 26,.") 

Therefore it would have been an obvious to one of an ordinary skill in art, having 
the teachings of Anderson and Ahuja in front of him at the time of invention was 
made, to incorporate teachings of Ahuja as one of "LOCATION DETERMINATION 
MODULES" as part of the "tiered estimation of geolocation of the internet host 
employing a number of processes of Anderson as shown in Fig. 11 such that 
estimation of the location of the internet host can be refined (corrected) as stated in Fig. 
4A. 

This would have been obvious because Ahuja states at col. 7, line 60-65, "Note 
that the topological location of an IP address can often be determined using the 
standard "traceroute" tool, which attempts to identify all of the router hops on a path 
selected to reach a destination. However, traceroute frequently provides incomplete 
information, particularly, because many routers do not respond to traceroute." 
Referring to claim 36, 
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Ahuja teaches at 




teaches a computer implemented method of determining the location of an Internet 
host using a first computer system (Fig. 5, element 200), comprising the following 
computer executable acts: 

measuring a first delay time (Fig. 5, element 53 ms) relating to a transmission 
from the first computer system to receipt of the transmission at the Internet host alone a 
first network path between a host IP address (Fig. 5, element 202) associated with the 
Internet host and the first computer system (col. 8, line 31-33, "For example, FIG. 5 
shows three sources 200, 206, 208 having distance estimates D1, D2, and D3 to 
destination 202, respectively."); 

measuring a second delay time (Fig. 5, element 100ms) relating to a 
transmission from a second computer system (Fig. 5, element 206) to receipt of the 
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transmission at the Internet host along a second network path between the host IP 
address (Fig. 5, element 202) and the second computer system (col. 8, line 31-33, "For 
example, FIG. 5 shows three sources 200, 206, 208 having distance estimates D1, D2, 
and D3 to destination 202, respectively."); 

measuring a third delay time (Fig. 5, element 150ms) relating to a transmission 
from a third commuter system (Fig.5, element 208) to receipt of the transmission at the 
Internet host along a third network path between the host IP address (Fig. 5, element 
202) and the third computer system (col. 8, line 31-33, "For example, FIG. 5 shows 
three sources 200, 206, 208 having distance estimates D1, D2, and D3 to destination 
202, respectively."); at least one of the first, second, and third network -paths containing 
at least one intermediate node; (col. 8, line 10-15, "For example, in fiber-optic cables, 
packets are known to travel at roughly two-thirds the speed of light in a vacuum. This 
rate will be affected by several factors including changes in the physical medium, 
curvature in the network paths, and latency added by routers or other devices.") 

correlating the first, second, and third delay times; and providing a location 
estimate of the location of the Internet host according to the correlation of the first, 
second, and third delay times. (Figs. 6 and 7, col. 8, line 33-41, "The source locations 
and distance estimates can be used to define intersecting circles 204, 210, 212, 
respectively, as shown in FIG. 6. If all of the distance estimates are upper bounds on 
the actual distances, then the destination must lie within the intersection of all such 
circles. This is also illustrated in FIG. 6, wherein destination 202 lies within the 
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intersection of circles 204, 210, 212. Note, that the diameters of circles 204, 210, 212 
are not drawn proportionally in this example.") 
Referring to claim 37, 
Ahuja teaches at 




teaches a computer implemented method of determining the location of an Internet 
host using a first computer system (Fig. 5, element 200), comprising the following 
computer executable acts: 

measuring a first delay time (Fig. 5, element 53 ms) relating to a transmission 
from the first computer system to receipt of the transmission at the Internet host alone a 
first network path between a host IP address (Fig. 5, element 202) associated with the 
Internet host and the first computer system (col. 8, line 31-33, "For example, FIG. 5 
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shows three sources 200, 206, 208 having distance estimates D1, D2, and D3 to 
destination 202, respectively."); 

measuring a second delay time (Fig. 5, element 100ms) relating to a 
transmission from a second computer system (Fig. 5, element 206) to receipt of the 
transmission at the Internet host along a second network path between the host IP 
address (Fig. 5, element 202) and the second computer system (col. 8, line 31-33, "For 
example, FIG. 5 shows three sources 200, 206, 208 having distance estimates D1, D2, 
and D3 to destination 202, respectively."); 

measuring a third delay time (Fig. 5, element 150ms) relating to a transmission 
from a third commuter system (Fig. 5, element 208) to receipt of the transmission at the 
Internet host along a third network path between the host IP address (Fig. 5, element 
202) and the third computer system (col. 8, line 31-33, "For example, FIG. 5 shows 
three sources 200, 206, 208 having distance estimates D1, D2, and D3 to destination 
202, respectively."); at least one of the first, second, and third network -paths containing 
at least one intermediate node; (col. 8, line 10-15, "For example, in fiber-optic cables, 
packets are known to travel at roughly two-thirds the speed of light in a vacuum. This 
rate will be affected by several factors including changes in the physical medium, 
curvature in the network paths, and latency added by routers or other devices.") 

correlating the first, second, and third delay times; and providing a location 
estimate of the location of the Internet host according to the correlation of the first, 
second, and third delay times. (Figs. 6 and 7, col. 8, line 33-41, "The source locations 
and distance estimates can be used to define intersecting circles 204, 210, 212, 
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respectively, as shown in FIG. 6. If all of the distance estimates are upper bounds on 
the actual distances, then the destination must lie within the intersection of all such 
circles. This is also illustrated in FIG. 6, wherein destination 202 lies within the 
intersection of circles 204, 210, 212. Note, that the diameters of circles 204, 210, 212 
are not drawn proportionally in this example.") 
Referring to claim 38, 

Claim 38 is a claim to a software tool for carrying out the method steps of claim 27. 
Therefore claim 38 is rejected for the reasons set forth for claims 27, 33 and 34. 
Referring to claim 39, 

Claim 39 is a claim to a computer-readable medium having computer executable 
instructions for carrying out the method steps of claim 27. Therefore claim 39 is 
rejected for the reasons set forth for claims 27, 33 and 34. 
Referring to claim 40, 

Claim 40 is a claim to a system for carrying out the method steps of claim 27. Therefore 
claim 40 is rejected for the reasons set forth for claims 27, 33 and 34. 
Referring to claim 41 , 

Claim 41 is a claim for geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process that includes the method of claim 27. 
Therefore claim 41 is rejected for the reasons set forth for claims 27, 33 and 34. 

Claim Rejections - 35 USC § 102 
8. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
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A person shall be entitled to a patent unless- 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21 (2) 
of such treaty in the English language. 



10. Claims 12, 13 and 23-26 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Ahuja et al. (hereinafter Ahuja) (US 6, 981, 055 B1) 
Referring to claim 12, 
Ahuja teaches at 



teaches a computer implemented method of determining the location of an Internet host 
using a first computer system (Fig. 5, element 200), comprising the following computer 
executable acts: 

measuring a first delay time (Fig. 5, element 53 ms) relating to a transmission 
from the first computer system to receipt of the transmission at the Internet host alone a 
first network path between a host IP address (Fig. 5, element 202) associated with the 
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Internet host and the first computer system (col. 8, line 31-33, "For example, FIG. 5 
shows three sources 200, 206, 208 having distance estimates D1, D2, and D3 to 
destination 202, respectively."); 

measuring a second delay time (Fig. 5, element 100ms) relating to a 
transmission from a second computer system (Fig. 5, element 206) to receipt of the 
transmission at the Internet host along a second network path between the host IP 
address (Fig. 5, element 202) and the second computer system (col.. 8, line 31-33, "For 
example, FIG. 5 shows three sources 200, 206, 208 having distance estimates D1, D2, 
and D3 to destination 202, respectively."); 

measuring a third delay time (Fig. 5, element 150ms) relating to a transmission 
from a third commuter system (Fig. 5, element 208) to receipt of the transmission at the 
Internet host along a third network path between the host IP address (Fig. 5, element 
202) and the third computer system (col. 8, line 31-33, "For example, FIG. 5 shows 
three sources 200, 206, 208 having distance estimates D1, D2, and D3 to destination 
202, respectively."); at least one of the first, second, and third network -paths containing 
at least one intermediate node; (col. 8, line 10-15, "For example, in fiber-optic cables, 
packets are known to travel at roughly two-thirds the speed of light in a vacuum. This 
rate will be affected by several factors including changes in the physical medium, 
curvature in the network paths, and latency added by routers or other devices.") 

correlating the first, second, and third delay times; and providing a location 
estimate of the location of the Internet host according to the correlation of the first, 
second, and third delay times. (Figs. 6 and 7, col. 8, line 33-41, "The source locations 
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and distance estimates can be used to define intersecting circles 204, 210, 212, 
respectively, as shown in FIG. 6. If all of the distance estimates are upper bounds on 
the actual distances, then the destination must lie within the intersection of all such 
circles. This is also illustrated in FIG. 6, wherein destination 202 lies within the 
intersection of circles 204, 210, 212. Note, that the diameters of circles 204, 210, 212 
are not drawn proportionally in this example.") 
Referring to claim 13, 

Ahuja teaches the method of claim 12, wherein correlating the first, second; and 
third delay times comprises triangulating the first, second, and third delay 
measurements. . (This is also illustrated in FIG. 6, wherein destination 202 lies within 
the intersection of circles 204, 210, 212. Note, that the diameters of circles 204, 210, 
212 are not drawn proportionally in this example." Note the boundaries created by the 
intersections of circles is triangle as shown in Fig. 6 pointing the location of source 202.) 
Referring to claim 23, 

Claim 23 is a claim to a software tool for carrying out the method steps of claim 12. 
Therefore claim 23 is rejected for the reasons set forth for claim 12. 
Referring to claim 24, 

Claim 24 is a claim to a computer-readable medium having computer executable 
instructions for carrying out the method steps of claim 12.. Therefore claim 24 is 
rejected for the reasons set forth for claim 12. 
Referring to claim 25, 
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Claim 25 is a claim to a system for carrying out the method steps of claim 12. 
Therefore claim 25 is rejected for the reasons set forth for claim 12. 
Referring to claim 26, 

Claim 26 is a claim for geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process that includes the method of claim 12. 
Therefore claim 26 is rejected for the reasons set forth for claim 12. 

Conclusion 

Examiner's note: Examiner has cited particular columns and line numbers in the 
references as applied to the claims above for the convenience of the applicant. 
Although the specified citations are representative of the teachings of the art and are 
applied to the specific limitations within the individual claim, other passages and figures 
may apply as well. It is respectfully requested from the applicant in preparing responses, 
to fully consider the references in entirety as potentially teaching all or part of the 
claimed invention, as well as the context of the passage as taught by the prior art or 
disclosed by the Examiner. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ashok B. Patel whose telephone number is (571) 272- 
3972. The examiner can normally be reached on 6:30 am-4:30 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nathan A. Flynn can be reached on (571) 272-1915. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-21; 
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